Free tools Windows power users keep installed
One-click scans. No signup required.
A firewall is a device or software service that enforces a security policy on network traffic. It examines connection information, compares it with rules, and permits, rejects, or logs traffic between networks or hosts with different security postures.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Firewalls can run on a computer, be built into a home router, operate as a dedicated appliance or virtual service, run in cloud infrastructure, or protect a web application. They reduce unauthorized access, but they do not replace updates, authentication, endpoint protection, backups, or sound network design.
As an Amazon Associate I earn from qualifying purchases.
What a firewall actually does
The term firewall describes a traffic-control function rather than one particular box or application. NIST defines firewalls as devices or programs that control network traffic between networks or hosts with different security postures. In practice, a firewall sits at a boundary and applies an administrator’s policy to traffic crossing that boundary.
It is a policy enforcement point, not an on/off barrier
A firewall does not simply make a network “open” or “closed.” Its rules can allow some traffic, deny other traffic, and record decisions for later review. A policy might allow a web server to receive HTTPS connections, permit employees to use approved DNS servers, and block unsolicited management traffic from the public internet.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Rules can match source and destination addresses, protocols, ports, applications, services, user or device identity, connection state, URL categories, reputation data, or inspected content. The exact options depend on the firewall’s placement and capabilities.
Where firewalls are deployed
- Host firewall: Runs on an individual computer or server and controls that host’s inbound and outbound connections.
- Router or appliance firewall: Sits between a local network and the internet, applying one policy to many devices.
- Virtual or cloud firewall: Filters traffic between virtual machines, cloud networks, subnets, or workloads.
- Web-application firewall: Operates in front of a web application and examines HTTP or HTTPS requests for abusive or malicious patterns.
How firewall inspection works
When a packet reaches a firewall, the firewall extracts relevant information, evaluates its rules, and then forwards, drops, rejects, or logs the packet. The decision may be based only on packet headers or may include connection state and application content.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Packet-filtering fundamentals
Basic packet filtering uses header fields such as:
- Source IP address: where the packet came from.
- Destination IP address: the host the packet is trying to reach.
- Source and destination ports: logical endpoints used by services and applications.
- Protocol: for example, TCP, UDP, or ICMP.
- Interface or zone: the network through which traffic entered or would leave.
A rule might say, “Allow TCP traffic from the internal network to a specified destination port, and deny other inbound traffic.” Rules are evaluated in the order and manner defined by the particular firewall. A final default action, often deny for unsolicited inbound traffic, handles traffic that does not match an explicit allow rule.
Stateless filtering
A stateless firewall evaluates each packet independently. It can be efficient and straightforward, but it does not remember whether a packet belongs to a connection that was previously permitted. Administrators must therefore write rules that account for both directions and the relevant return traffic.
Rank #2
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Stateful inspection
A stateful firewall keeps a table of active connections. When an internal device starts an allowed TCP session, the firewall records the expected addresses, ports, protocol, and connection state. Return packets that fit that session can pass without requiring a separate broad inbound rule. Packets that claim to be part of a session but do not match the expected state can be rejected.
State tracking helps distinguish a response to a request from an unsolicited connection attempt. It is not a guarantee that the contents of an allowed session are safe; it only verifies that the traffic fits the recorded connection.
Recommended Free Tools
Application-aware and next-generation inspection
More advanced firewalls identify applications and protocols beyond port numbers. They may inspect application context, use intrusion-prevention signatures, filter URLs or reputation categories, consult threat-intelligence data, terminate and re-encrypt traffic for inspection where configured, or apply policies by user and device. These features require more processing, accurate updates, and careful administration. A firewall with such features is not automatically a complete intrusion-detection, endpoint-security, or malware-defense program.
A packet’s path through a firewall
- The packet arrives on an interface or network zone.
- The firewall reads its header and, if enabled, connection-state and application information.
- It evaluates the applicable rules, objects, schedules, identities, and security profiles.
- It records the decision when logging is enabled.
- It forwards, drops, or rejects the packet and may apply translation, inspection, or rate controls.
Firewall types compared
| Type and placement | Typical policy scope | Inspection depth | Operational considerations |
|---|---|---|---|
| Host-based software firewall | One computer, phone, server, or virtual machine | Addresses, ports, protocols, applications, services, and sometimes connection state | Useful for controlling lateral traffic and protecting devices outside the home network; rules must be managed on each host or through central administration. |
| Router or hardware firewall | Home or small-office network boundary | Usually stateful packet inspection, with capabilities varying by model | Protects many devices at one boundary; throughput, update support, wireless features, logging, and management quality matter. |
| Dedicated network appliance | Business segments, data centers, or larger sites | Stateful and often application-aware inspection, VPN, intrusion prevention, filtering, and centralized policy | Requires planned rule management, monitoring, updates, capacity planning, and administrators with appropriate skills. |
| Cloud or virtual firewall | Cloud networks, subnets, workloads, or virtual interfaces | Network-layer controls and, depending on the service, higher-layer inspection | Must align with cloud routing, identity, logging, scaling, and provider-specific limits. |
| Web-application firewall | A public web application or API | HTTP/HTTPS requests, headers, parameters, sessions, and attack patterns | Needs application-aware tuning to reduce false positives and does not protect unrelated network services. |
What does a firewall block?
The answer depends on its rules and location. Common examples include:
Rank #3
- Quad Core J3710 Processor: F3 firewall hardware with Pentium J3710 Processor, 4 Cores 4 Threads, 2M Cache, up to 2.64 GHz, TDP 6.5 W. Compatible with pfsense, OPNsense, Linux, ESXi, Proxmox
- 4 x i225V 2.5GbE LAN: J3710 mini pc with 4 x i225V 2500Mbps LAN, can monitor network data, improve network security, powerful and widely used
- DDR3 RAM mSATA Slot: J3710 firewall pc with 1 x DDR3L SO-DIMM memory, 1 x mSATA SSD slot, 1 x SATA 3.0 slot(SATA Cable included), 1 x Mini-PCIe Slot
- HD DP Dual Display: Micro firewall appliance J3710 integrated HD Graphics, HD + DP dual display interfaces improve work efficiency
- Fanless Mini Size: Firewall appliance J3710 with aluminium alloy body, fanless quiet running without noise. Size only 11 x 10 x 3.5 cm
| Traffic or behavior | Possible firewall action | Important qualification |
|---|---|---|
| Unsolicited inbound connection to a workstation | Drop or reject it unless a rule allows the service | An exposed service can still be vulnerable if it is poorly configured or unpatched. |
| Outbound connection to a prohibited address, port, or application | Block and optionally log it | Outbound control must be configured; many basic policies allow outbound traffic by default. |
| Packets that do not match an active connection | Reject as invalid or unsolicited | Stateful inspection relies on an accurate connection table and protocol handling. |
| Traffic from a blocked network, country category, reputation list, or URL group | Deny or challenge it | Reputation and category data can be incomplete or incorrect and require updates. |
| Web requests matching attack signatures or policy violations | Block, rate-limit, or log the request | Web-application rules must be tuned to the application’s normal requests. |
Blocking a port does not remove the application using it, and allowing a port does not make the application trustworthy. A rule controls reachability; the service still needs secure configuration, authentication, and timely patches.
Firewall versus antivirus and other controls
| Control | Primary question it answers | What it generally does not do |
|---|---|---|
| Firewall | Should this network connection or request be allowed under policy? | It does not by itself prove that an allowed file, process, or user is safe. |
| Antivirus or endpoint detection | Is a file, process, or behavior malicious on the device? | It is not a substitute for controlling which hosts and services can connect. |
| Authentication and authorization | Who or what is requesting access, and what may it do? | Valid credentials can still be abused if the account or application is compromised. |
| Patch management | Are known software vulnerabilities fixed? | Patched software can still be exposed through excessive network access. |
| Backup and recovery | Can data and services be restored after loss or compromise? | Backups do not prevent an attack or block traffic. |
These controls address different failure modes. A layered design uses them together instead of treating a firewall as a complete security system.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do you need a firewall if you have a router?
Usually, yes, but the answer depends on what the router actually provides. A typical internet router includes a hardware firewall function that separates the local network from the internet. It commonly uses stateful inspection and blocks unsolicited inbound traffic unless port forwarding or another rule permits it.
Many computers also run host-based firewalls. The router protects the network boundary; the host firewall can limit traffic between devices on the same network, protect a laptop on untrusted Wi-Fi, and enforce application-specific rules. Using both creates separate control points.
Rank #4
- BUSINESS READY - pfSense+ software updates included for product lifetime. Netgate TAC Lite technical support included. One year hardware warranty included.
- COMPLETE - Pre-loaded with pfSense+ software to get up and running fast. Simply unbox it and start customizing for your secure edge networking needs. Free help with setup from our expert Technical Assistance Center (TAC) available 24/7/365.
- POWERFUL - A dual core ARM Cortex-A53 1.2 GHz delivers near gigabit routing of common home iPerf3 traffic and in excess of 650 Mbps of firewall throughput.
- COMPACT - Low power draw, a compact form factor, and silent operation allow it to run unnoticed when placed on a desktop, wall, or rack.
- FLEXIBLE - Three (3) 1 GbE switched (WAN/LAN/OPT) ports allow you to configure three separate 1 GbE switched ports for upto a gigabit of bi-directional traffic.
NAT is not the same thing as a firewall
Network address translation (NAT) changes address information so multiple private devices can share a public address. NAT often makes unsolicited inbound connections harder to initiate, but that side effect is not a complete security policy. A firewall explicitly evaluates traffic and can log, allow, or deny it according to rules. Do not assume that a device providing NAT has every firewall feature you need.
When a router firewall may be insufficient
- You need to control traffic between internal departments, VLANs, or sensitive devices.
- You require detailed logs, centralized administration, VPN access, intrusion prevention, or application controls.
- You expose public services and need separate policies for servers and user devices.
- The router no longer receives security updates or cannot handle your traffic volume.
- Devices leave the home or office and connect from networks outside the router’s protection.
How common host firewalls behave
Microsoft’s Windows documentation describes the default behavior as blocking incoming traffic unless it is solicited or matches a rule, while allowing outgoing traffic unless a rule blocks it. Rules can be based on addresses, protocols, ports, applications, and services.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →This default explains two common experiences: an internet connection can work while an unsolicited inbound service remains unreachable, and a program can still make outbound connections unless an administrator creates an outbound block. Exact defaults and labels vary by operating-system version and profile, so verify the active network profile and rule set rather than relying on assumptions.
Setting up a firewall safely at home or in a small office
Router boundary
- Sign in to the router’s administration interface and confirm that its firmware is current and still supported.
- Enable the firewall or security setting for the internet-facing interface.
- Keep unsolicited inbound connections blocked by default.
- Review port-forwarding, exposed-host, remote-administration, and universal plug-and-play settings. Remove entries you do not recognize or need.
- Use a strong, unique administrator password and multifactor authentication if the router supports it. Disable administration from the public internet unless there is a specific, protected need.
- Create only the narrow exceptions required for a service: specify the destination device, protocol, port, source scope, and schedule where supported.
- Enable useful logging, but set retention and alerting so important events are not buried in noise.
- Test from an external network and from the local network. Confirm that required services work and that unrelated ports remain unreachable.
Host firewall
- Leave the operating system’s firewall enabled unless another product explicitly replaces it.
- Identify the active network profile, such as private, public, or domain-managed.
- Allow applications or services by specific executable, service, port, and network scope rather than opening a broad range.
- Keep inbound rules disabled when the service is not needed. Review outbound rules when you have a clear monitoring or containment requirement.
- Record why each exception exists, who approved it, and when it should be reviewed.
Designing rules that remain manageable
Start with the least access needed for a documented business or household function. Use named address groups, service objects, and network zones so a rule explains its intent. Separate user devices, servers, guest devices, and management interfaces when the network supports segmentation.
Best Value
- Entry-Level Privacy Gateway: Designed for users who want simple online privacy protection at an affordable level—ideal for basic home networking and daily internet use.
- Secure Browsing for Everyday Needs: Perfect for email, social media, online shopping, and standard streaming—protecting your connection while keeping setup and operation easy.
- Lightweight Protection Against Common Online Threats: Helps reduce exposure to unwanted ads, trackers, and risky websites, improving online safety for your household.
- Simple Setup, No Technical Skills Required: Plug it in, follow the quick steps, and start using—an excellent choice for beginners who don’t want complicated network configurations.
- Decentralized VPN (DPN) Included – No Monthly Payments: Get built-in decentralized VPN access with lifetime free usage, helping you stay private without paying recurring subscription fees
- Prefer specific sources and destinations: Limit a rule to the required hosts or subnet instead of “any.”
- Specify protocol and port: Do not allow all protocols when one is required.
- Control direction: Distinguish inbound, outbound, and inter-segment traffic.
- Place exceptions carefully: A broad allow rule above a deny rule can unintentionally override the policy.
- Log meaningful events: Record denied management attempts and important allowed services, while avoiding excessive logs that obscure incidents.
- Review lifecycle: Remove temporary rules, check ownership, and reassess rules when applications, networks, or threats change.
Troubleshooting a blocked connection
- Define the expected flow. Identify the source device, destination, protocol, port, direction, and whether the connection should be initiated or is a response to an existing session.
- Check the correct firewall. A router, host firewall, cloud security group, and web-application layer can each block the same request.
- Read logs at the time of the test. Look for the rule ID, interface, source, destination, and reason. A missing log entry may mean the traffic took another path or logging is disabled.
- Verify routing and name resolution. A wrong address, route, DNS result, or VLAN can look like a firewall block.
- Check service status. Confirm that the destination application is running and listening on the expected interface and port.
- Test narrowly. Temporarily create the smallest, source-limited rule needed to confirm the cause. Remove or tighten it after testing.
- Check state and timeouts. Stateful devices can discard long-idle sessions or mishandle unusual protocols when connection tracking expires.
Do not solve an unknown block by opening every port or disabling every firewall. That hides the actual cause and creates a larger exposure.
Choosing a firewall approach
Compare options using the requirements that affect your environment:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Decision area | Questions to answer |
|---|---|
| Placement | Do you need protection for one endpoint, an entire home network, internal segments, cloud workloads, or a public web application? |
| Inspection depth | Are packet headers and connection state sufficient, or do you need application identification, URL controls, reputation, or content inspection? |
| Policy scope | Will rules apply to one host, a subnet, users and devices, a cloud identity, or a web request? |
| Operations | Who will write and review rules, investigate logs, apply updates, test changes, and respond to alerts? |
| Capacity | Can the platform maintain required throughput, concurrent connections, VPN sessions, and inspection features without unacceptable delay? |
| Resilience | What happens during a power loss, device failure, expired subscription, or unavailable cloud control plane? |
| Updates and support | How long will firmware, signatures, operating-system components, and management software receive security updates? |
Firewall maintenance checklist
- Review rules and port forwards on a defined schedule and after major application or network changes.
- Remove unused, duplicate, temporary, and ownerless rules.
- Update firmware, operating systems, inspection signatures, reputation feeds, and cloud policy components.
- Monitor denied traffic for attack patterns and allowed traffic for unexpected destinations or volumes.
- Back up configurations securely and test restoration.
- Document network zones, critical services, emergency contacts, and approved exceptions.
- Periodically test from both trusted and untrusted networks.
- Pair firewall controls with patching, strong authentication, endpoint security, segmentation, backups, and incident-response procedures.
Bottom line
A firewall works by comparing network traffic with a security policy and enforcing the resulting allow, deny, or log decision. Stateless filters inspect packets individually; stateful firewalls track active sessions; application-aware systems add higher-layer controls. A router firewall and a host firewall protect different boundaries, so many home and small-office networks benefit from both. The protection is effective only when rules are narrowly scoped, maintained, monitored, and combined with the rest of a sound security program.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
